[naji247]

Summary

Fixes the five open HIGH/CRITICAL Dependabot alerts on the root pnpm-lock.yaml. Only package.json (two lines in pnpm.overrides) and pnpm-lock.yaml change. No source changes.

Alert	Package	Advisory	Before → After	Fix
https://github.com/agentcathq/webmcp-react/security/dependabot/145 (critical, dev)	tinypool	GHSA-5gmw-xhrv-c9v3	1.1.1 → 2.2.0	scoped override "tinypool@1": ">=2.1.2"
https://github.com/agentcathq/webmcp-react/security/dependabot/144 (critical, dev)	tinypool	GHSA-85c8-ppgw-ccpr	1.1.1 → 2.2.0	same override
https://github.com/agentcathq/webmcp-react/security/dependabot/142 (critical, runtime)	proxy-addr	GHSA-jqcg-44mw-7w3h	2.0.7 → 2.0.8	in-range lockfile update (express wants ^2.0.7)
https://github.com/agentcathq/webmcp-react/security/dependabot/146 (high, runtime)	sharp	GHSA-wq5f-xc86-pv6w	0.35.4 → 0.35.5	existing override raised from >=0.35.4 to >=0.35.5
https://github.com/agentcathq/webmcp-react/security/dependabot/143 (high, dev)	source-map-js	GHSA-68fv-2mgg-jv7q	1.2.1 → 1.2.2	in-range lockfile update (postcss wants ^1.2.1)

How each package was fixed

tinypool (vitest@3.2.7 → tinypool ^1.1.1). The 1.x line has no patched release: 1.1.1 (June 2025) is the last 1.x version, and the fixes shipped as 2.1.1 and 2.1.2. That left two options: bump vitest to 4.x, which no longer depends on tinypool at all, or add a scoped override. I tried vitest@4.1.12 first. The lockfile diff was clean and 306 of 310 tests passed, but 4 tests in examples/native-harness/src/App.test.tsx failed: under the vitest 4 jsdom environment, the default abort reason from AbortController.abort() is no longer instanceof the global DOMException, so the harness (App.tsx, around line 323) falls back to String(reason) and prints tool: AbortError: This operation was aborted instead of tool: AbortError. Fixing that needs an example-code change, which does not belong in a security patch. This PR therefore keeps vitest 3.2.7 and adds the scoped override "tinypool@1": ">=2.1.2", which resolves to tinypool 2.2.0. The only breaking change in tinypool 2.0.0 is dropping Node 18; CI runs Node 20 and 22, and the full suite passes with it.

Follow-up: bump vitest to ^4.1.12 in its own PR (with the harness fix). That also closes the medium alerts 127/128/129 (GHSA-82fw-gwwq-j7x9) and lets us delete this override.

proxy-addr (@modelcontextprotocol/sdk@1.32.1 → express@5.2.1 → proxy-addr ^2.0.7, via extension). Lockfile-only bump to 2.0.8 (temporary override, install, override removed, install again). packages/webmcp-server depends on the same SDK but is published separately and has no lockfile, so its consumers already resolve proxy-addr 2.0.8 at install time; nothing to change there.

sharp (next@15.5.25 → sharp, via examples/nextjs). Raised the existing override. This also moves @img/sharp-* to 0.35.5 and @img/sharp-libvips-* from 1.3.3 to 1.3.4, which is where the native fix lives.

source-map-js (postcss@8.5.26 → source-map-js ^1.2.1; postcss comes from next, tsup and vite). Lockfile-only bump to 1.2.2, same temporary-override method.

Verification

• rm -rf node_modules && pnpm install --frozen-lockfile (pnpm 10.34.5, Node 22) succeeds.
• pnpm build, pnpm typecheck, pnpm lint, pnpm test (19 files, 310 tests, no type errors), pnpm --filter webmcp-bridge-extension build and typecheck all pass, same as on main.
• Lockfile grep: no tinypool@1.x, proxy-addr@2.0.7, sharp@0.35.4 or source-map-js@1.2.1 entries remain.

Related

• Dependabot's build(deps): bump the npm-security group across 1 directory with 4 updates #78 bumps next, @vitest/mocker (3.2.7 → 5.0.5), ip-address and source-map-js; its CI failed. It overlaps with this PR only on source-map-js.
• The remaining open alerts are all medium or low (next, hono, ip-address, qs, fast-uri, vitest, esbuild) and are out of scope here.